[Pkg-mozext-maintainers] Bug#591579: Bug#591579: RFP: https-everywhere -- browser extension to enforce SSL browsing according to rules

[Rogério Brito]

Hi there.

I really hope that this message gets through. Please let me know if it
works.

On Aug 10 2011, Jérémy Bobbio wrote:
> If you already have an alioth account, please request to join the
> pkg-mozext team.

Just requested.

> I'll add you to the project and you can move the Git repository to the
> location mentioned in the Vcs-Git field.

Yes, not being able to write to the group's repository is the reason why I
had it in collab-maint.

For the moment, it is still at the same address [0], but it will be moved as
soon as I get write access to the repository.

[0]: http://anonscm.debian.org/gitweb/?p=collab-maint/https-everywhere.git

>  * `${shlibs:Depends}` is listed in Depends. The package being
>    arch `all`, I don't think it is ever going to be linked to
>    a share library. It can probably be removed for cleanliness.

Oh, great. Removed.

>  * The URL to the Git repository should be updated in README.source.

OK, done, as per your request.

>  * I see that you are using bzip2 compression for the debs. Have you
>    measured how much gain resulted in doing so?

Yes, I did: with bzip2, we get, for https-everywhere, a package that is 10%
smaller than with gzip, which, for compression algorithms, is quite a good
amount.

I would have used xz instead of bzip2, though, as xz-utils is "Priority:
required", but people would find that to be too aggressive. :-)

Regarding one point that Axel mentioned about using pristine-tar,
unfortunately, the tor project only seems to release xpi files, which are
actually zip files, but pristine-tar only supports gzip or bzip2 compressed
tar files.

I agree that for traceability (if that's even a word) would be better if we
could have bit-identical tarballs, but that's not an option, unless we:

* ask upstream to produce tar.{gz,bz2} tarballs
* grab our tarballs from https://gitweb.torproject.org/https-everywhere.git,
  but, AFAIK, we loose the automation of checks with uscan and with uupdate

> No other comments. Except for the URLs of the repositories, I would have
> uploaded it right now! :)

Great. I hope that what I produced is not to be ashamed of. :-) Please, let
me know if you would like to have the package as a .dsc combo.


Regards,

-- 
Rogério Brito : rbrito@{ime.usp.br,gmail.com} : GPG key 4096R/BCFCAAAA
http://rb.doesntexist.org : Packages for LaTeX : algorithms.berlios.de
DebianQA: http://qa.debian.org/developer.php?login=rbrito%40ime.usp.br